From 4b27670ea25b955b710021151471cb252240b1e0 Mon Sep 17 00:00:00 2001 From: Tigran Mkrtchyan Date: Fri, 9 Oct 2026 17:58:02 +0200 Subject: [PATCH] nfsv4/pnfs: use the MDS authflavor for data server connections When a pNFS client connects to an NFSv4.1 data server, the EXCHANGE_ID is always attempted with RPCSEC_GSS krb5i first, even if the auth flavor with the MDS is AUTH_SYS. On a host that runs rpc.gssd but has no usable machine credential, every first contact with a data server therefore upcalls to rpc.gssd before falling back to AUTH_SYS. As nfs4_discover_server_trunking is serialized by nfs_clid_init_mutex such an extra upcall creates a backlog of DS connections when many files accessed in parallel. Pass the authflavor of the MDS lease to nfs4_alloc_client() and skip the krb5i attempt if the MDS already ended up with AUTH_SYS. Nothing changes for the MDS itself, or for data servers of an MDS whose lease was established with krb5i. Fixes: 4edaa308888b ("NFS: Use "krb5i" to establish NFSv4 state whenever possible") Signed-off-by: Tigran Mkrtchyan Signed-off-by: Anna Schumaker --- fs/nfs/internal.h | 1 + fs/nfs/nfs4client.c | 7 ++++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h index 42f170973000..f6f7f70b21e2 100644 --- a/fs/nfs/internal.h +++ b/fs/nfs/internal.h @@ -86,6 +86,7 @@ struct nfs_client_initdata { struct xprtsec_parms xprtsec; unsigned long connect_timeout; unsigned long reconnect_timeout; + rpc_authflavor_t authflavor; /* Auth flavor to use for DS connection */ }; /* diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c index 5d054d3dced1..440f8496b717 100644 --- a/fs/nfs/nfs4client.c +++ b/fs/nfs/nfs4client.c @@ -230,8 +230,12 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) /* * Set up the connection to the server before we add add to the * global list. + * + * Prefer krb5i unless the caller already knows AUTH_UNIX is required. */ - err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_GSS_KRB5I); + err = -EINVAL; + if (cl_init->authflavor != RPC_AUTH_UNIX) + err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_GSS_KRB5I); if (err == -EINVAL) err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_UNIX); if (err < 0) @@ -816,6 +820,7 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv, .cert_serial = TLS_NO_CERT, .privkey_serial = TLS_NO_PRIVKEY, }, + .authflavor = mds_clp->cl_rpcclient->cl_auth->au_flavor, }; char buf[INET6_ADDRSTRLEN + 1];